See the built in audit and extd_audit VFS modules.
http://us1.samba.org/samba/docs/man/Samba3-HOWTO/VFS.html
> I saw that this was brought up before in the archives, but never answered.
> My question is how can I set samba to log only which IPs (or hostnames)
> transfer which files to and from the server so that I can run an analysis of
> its usage?
> I have tried using the built in logging feature, but it creates a massive
> amount of information, most of which is not useful for my purposes.
> Any help would be appreciated.
> Charlie Meyer
> Computer Science
> University of Illinois at Urbana-Champaign
>cemeyer2 at uiuc.edu